The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates the content of arbitrary Markdown files directly into its LLM requests without sanitization or delimitation.
Ingestion points: The script scripts/enrich.py reads Markdown files from the local file system using open(path).read().
Boundary markers: The skill does not use boundary markers (such as XML tags or specific delimiters) to separate user-provided content from the system instructions in the call_deepseek function.
Capability inventory: The skill possesses the capability to overwrite local Markdown files and communicate with external API endpoints.
Sanitization: No sanitization, escaping, or "ignore instructions" warnings are applied to the input text before it is sent to the LLM for processing.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs network operations to a well-known service to process content.
Evidence: The script uses urllib.request to send content to the DeepSeek API (https://api.deepseek.com/v1/chat/completions). This is the intended behavior of the skill and follows standard security practices by using environment variables for API keys.

content-enrich